CVE-2019-10442: Jenkins iceScrum Plugin Missing Authorization
Summary
CVE-2019-10442: Jenkins iceScrum Plugin vulnerable to Missing Authorization. Affects org.jenkins-ci.plugins:icescrum versions < 1.1.6. Fixed in 1.1.6. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Jenkins iceScrum Plugin is a Maven package that integrates the iceScrum project management tool with Jenkins. It allows users to connect to an iceScrum instance and perform various actions related to project management. The plugin provides functionality for creating, updating, and deleting iceScrum tasks, as well as retrieving information about projects and sprints. It is commonly used by development teams to streamline their workflow and improve collaboration.
Vulnerability Detail
The Jenkins iceScrum Plugin prior to version 1.1.6 is vulnerable to Missing Authorization. This means that attackers with Overall/Read permission can connect to a specified URL using attacker-specified credentials. This vulnerability can be exploited by an attacker to gain unauthorized access to sensitive information or perform malicious actions within the iceScrum instance. The issue has been patched in version 1.1.6.
How To Fix
Minimum fixed version
1.1.6
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to upgrade to the patched version as soon as possible.
Conclusion
The Jenkins iceScrum Plugin prior to version 1.1.6 is vulnerable to Missing Authorization, which can allow attackers with Overall/Read permission to gain unauthorized access to an iceScrum instance. Users should upgrade to version 1.1.6 to fix this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.plugins:icescrum →
FAQ
This vulnerability allows attackers with Overall/Read permission to connect to a specified URL using attacker-specified credentials. This can lead to unauthorized access to sensitive information or malicious actions within the iceScrum instance.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Simply provide your pom.xml file and the playground will analyze it for open-source vulnerabilities, including this one.
Yes, the CVSS score for this vulnerability is 4.3, indicating a moderate severity level.
There are no known public exploits for this vulnerability at the time of this report. However, it is always recommended to patch vulnerabilities as soon as possible to mitigate the risk of potential exploits.
You can find more information about version 1.1.6 of the Jenkins iceScrum Plugin in the release notes or documentation provided by the plugin's maintainers.
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.plugins:icescrum.
